Behavioral task
behavioral1
Sample
1416-89-0x0000000000400000-0x00000000004CC000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1416-89-0x0000000000400000-0x00000000004CC000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1416-89-0x0000000000400000-0x00000000004CC000-memory.dmp
-
Size
816KB
-
MD5
61d03e7987f28719bbbe06ba894b706e
-
SHA1
e0e13814e12207363e3e52553d6e9b6d2bbded3f
-
SHA256
ce3f93e47845e2b665a5505c29de94f5f5029ff6b108bb8c09a1f138e1d6597e
-
SHA512
b4806d73b83041e3287e1b225498e08c0381897bee8633a744e88d395ecda5e555b25d07c156d30cf2fd7058fc33390784209dfd2b97abdce8de9a5f7473ac95
-
SSDEEP
24576:pQPPMJA5eeG94zr8XIiaBxgvwsASFzRmHtW:pQPdtrTiixS7etW
Malware Config
Extracted
cryptbot
http://lahrom42.top/gate.php
-
payload_url
http://ahowaj05.top/bhakti.dat
Signatures
-
Cryptbot family
Files
-
1416-89-0x0000000000400000-0x00000000004CC000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 605KB - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ